RSA NetWitness Logs. Microsoft SharePoint Server. Event Source Log Configuration Guide. Last Modified: Friday, June 02, 2017

Transcription

1 RSA NetWitness Logs Event Source Log Configuration Guide Microsoft SharePoint Server Last Modified: Friday, June 02, 2017 Event Source Product Information: Vendor: Microsoft Event Source: SharePoint Server Versions: 2007, 2010 and 2013 Additional Downloads: LOGbinder SP (for SharePoint 2007); LOGbinder SP 2.0 (for SharePoint 2010); LOGbinder SP 3.1 (for SharePoint 2010); LOGbinder SP4.0 (for SharePoint 2013) RSA Product Information: Supported On: NetWitness Suite 10.0 and later Event Source Log Parser: mssharepoint Collection Method: Windows Eventing Event Source Class.Subclass: Storage.Storage

2 Configure Microsoft SharePoint Server To configure Microsoft SharePoint Server to work with RSA NetWitness Suite, you must complete these tasks: I. Configure LOGbinder SP II. Configure Microsoft SharePoint Server using Windows Collection 2 Configure Microsoft SharePoint Server

3 Configure LOGbinder SP Important: To collect auditing events from Microsoft SharePoint Server into the Windows Event Viewer, you must download the third-party application LOGbinder SP from To configure LOGbinder SP: 1. Depending on your version of Microsoft SharePoint, do one of the following: For Microsoft SharePoint 2007, download LOGbinder SP from For Microsoft SharePoint 2010, download LOGbinder SP 2.0 or LOGbinder SP 3.1 from For Microsoft SharePoint 2013, download LOGbinder SP 4.0 from 2. To configure the input settings, follow these steps: a. In the LOGbinder SP interface, click Input. b. Double-click the site collector that you want to audit. c. From the Site Collector window, select the type of event to audit. d. Click OK. 3. To configure the output settings, follow these steps: a. Click Output. b. If you are using LOGbinder SP or LOGbinder SP 2.0, double-click Windows Event Logs. If you are using LOGbinder SP 3.1 or 4.0, click LOGbinder SP Event Log. c. If you are using LOGbinder SP or LOGbinder SP 2.0, ensure that Send Output to Windows Event Log is selected. If you are using LOGbinder SP 3.1 or 4.0, ensure that Send output to LOGbinder SP Event Log is selected. d. Click OK. 4. To start the service, click Service > Start. Configure LOGbinder SP 3

4 Configure Microsoft SharePoint Server using Windows Collection Note: In the procedure below, when listing the Channels from which to collect, enter LOGbndSP. There are two parts to configuring Windows collection: I. Configure WinRM on the Windows Host II. Configure Security Analytics for Windows Collection. Configure WinRM on a Windows Host This section describes a shortcut method to configure the Windows host. It assumes that you have the following two RSA scripts available: useradd: sets up a user account with the necessary permissions. RSA_SA_winevent_config.vbs: sets up the WinRM listener To set up and run the useradd script: 1. Open useradd.vbs for editing. 2. You need to enter your values for the following two parameters: User account: in the Name field, enter the name for the RSA user account. Domain: in the compname parameter, enter your domain name. Note: For the remainder of this document, we are using example values: rsalog for the user account, and dsnetworking.com for the domain name. 3. On the Windows host, open a Command Prompt, and run useradd: c:\program Files\scripts>useradd.vbs Note: You need to run the script as an administrator. The script prompts you to open the file. Click Yes to run the script and set up your user. 4 Configure Microsoft SharePoint Server using Windows Collection

5 To run the script to set up the WinRM listener: 1. On the Windows host, open a Command Prompt. 2. Navigate to the folder where the script is stored, and run it as follows: rsa_sa_winevent_config.vbs http The script prompts you with a series of information and verification screens: accept them as they appear, in order to have the script succeed. This completes your set up on the Windows host. Next, you configure Security Analytics. Configure Security Analytics for Windows Collection In Security Analytics, you need to configure the Kerberos Realm, and then add the Windows Event Source type. To configure the Kerberos Realm for Windows collection: 1. In the Security Analytics menu, select Administration > Services. 2. In the Services grid, select a Log Collector, and from the Actions menu, choose View > Config > Event Sources. 3. Select Windows/Kerberos Realm from the drop-down menu. 4. In the Kerberos Realm Configuration panel toolbar, click + to add a new realm. The Add Kerberos Domain dialog is displayed. Configure Security Analytics for Windows Collection 5

6 5. Fill in the parameters, using the guidelines below. Parameter Kerberos Realm Name KDC Host Name Details Enter the realm name, in all caps. For example, DSNETWORKING.COM. Note that the Mappings parameter is automatically filled with variations on the realm name. Enter the name of the Domain Controller. Do not use a fully qualified name here: just the host name for the DC. Note: Make sure that the log collector is configured as a DNS client for the corporate DNS server. Otherwise, the LC will not know how to find the Kerberos Realm. Admin Server (Optional) The name of the Kerberos Administration Server in FQDN format. 6. Click Save to add the Kerberos domain. Next, continue from the current screen to add a Windows Event Category and type. To configure the Windows Event Type: 1. Select Windows/Config from the drop-down menu. 2. In the Event Categories panel toolbar, click + to add a source. The Add Source dialog is displayed. 6 Configure Security Analytics for Windows Collection

7 3. Fill in the parameters, using the guidelines below. Parameter Alias Authorization Method Channel User Name Password Max Events Per Cycle Polling Interval Details Enter a descriptive name. Choose Negotiate. For most event sources that use Windows collection, you want to collect from the Security, System, and Application channels. Enter the account name for the Windows user account that you set up earlier for communicating with Security Analytics. Note that you need to enter the full account name, which includes the domain. For example, rsalog@dsnetworking.com. Enter the correct password for the user account. (Optional). RSA recommends that you set this value to 0, which collects everything. (Optional). For most users, a value of 60 should work well. 4. Click OK to add the source. The newly added Windows event source is displayed in the Event Categories panel. 5. Select the new event source in the Event Categories panel. The Hosts panel is activated. 6. Click + in the Hosts panel toolbar. 7. Fill in the parameters, using the guidelines below. Parameter Event Source Address Details Enter the IP address for the Windows host. Port Accept the default value, Transport Mode Enabled Enter http. Ensure the box is checked. 8. Click Test Connection. Configure Security Analytics for Windows Collection 7

8 Note: In Security Analytics versions prior to 10.4 patch 2, the Windows service had to be running in order for the test connection to work. In later versions, you should be able to successfully test the connection, even if the Windows service is not running. For more information on any of the previous steps, see the following Help topics in the Security Analytics User Guide: Configure Windows Collection: Microsoft WinRM Configuration Guide: Test and Troubleshoot Microsoft WinRM Guide: Copyright 2017 EMC Corporation. All Rights Reserved. Trademarks RSA, the RSA Logo and EMC are either registered trademarks or trademarks of EMC Corporation in the United States and/or other countries. All other trademarks used herein are the property of their respective owners. 8 Configure Security Analytics for Windows Collection